---
title: "no-implied-eval"
description: "Disallow passing a string of code to `setTimeout()`, `setInterval()` or `execScript()`"
# Generated by src/codegen/lint-rule-docs.ts. Do not edit below this line.
plugin: "eslint"
aliases: ["eslint/no-implied-eval"]
kind: "suggestion"
category: "suspicious"
default: "off"
fixable: "no"
typeAware: false
deprecated: false
---

When the first argument of `setTimeout()` or `setInterval()` is a string, browsers compile and run it like `eval()` does. The code runs in the global scope, so it can't see your local variables, and anything a user typed that ends up in the string gets executed.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"no-implied-eval" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad {"count": 3} */}
```js
setTimeout("refresh()", 1000);
setInterval("poll('" + url + "')", 5000);
window.setTimeout(`save(${id})`, 0);
```

The rule follows a constant that holds a string:

{/* bad */}
```js
const code = "refresh()";
setTimeout(code, 1000);
```

Not reported:

{/* good */}
```js
setTimeout(refresh, 1000);
setInterval(() => poll(url), 5000);
window.setTimeout(() => save(id), 0);
```

Your own function with the same name isn't reported:

{/* good */}
```js
import { setTimeout } from "./fake-timers.js";

setTimeout("tick", 1000);
```